|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: UwU UwU <uwu7586@gmail.com> |
| 3 | +Date: Tue, 19 Apr 2022 15:10:38 +0000 |
| 4 | +Subject: NavigatorManagedData: Prevent iterator invalidation during Promise |
| 5 | + resolution |
| 6 | + |
| 7 | +(cherry picked from commit 6083135252280d9b43e26169eb35154a9ac861ea) |
| 8 | + |
| 9 | +Bug: 1307223 |
| 10 | +Change-Id: Iead6cf8c6236a95dbdfe7877c912f6ba86b370ac |
| 11 | +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3532439 |
| 12 | +Commit-Queue: Anqing Zhao <anqing@chromium.org> |
| 13 | +Cr-Original-Commit-Position: refs/heads/main@{#984230} |
| 14 | +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3577263 |
| 15 | +Reviewed-by: Artem Sumaneev <asumaneev@google.com> |
| 16 | +Owners-Override: Artem Sumaneev <asumaneev@google.com> |
| 17 | +Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> |
| 18 | +Cr-Commit-Position: refs/branch-heads/4664@{#1591} |
| 19 | +Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} |
| 20 | + |
| 21 | +diff --git a/third_party/blink/renderer/modules/managed_device/navigator_managed_data.cc b/third_party/blink/renderer/modules/managed_device/navigator_managed_data.cc |
| 22 | +index 2df64ff2c51dfe080cd50b46199e9c1d77ea26db..32b48ca0157a52d322aa4e00d18d4e662d3b1c4a 100644 |
| 23 | +--- a/third_party/blink/renderer/modules/managed_device/navigator_managed_data.cc |
| 24 | ++++ b/third_party/blink/renderer/modules/managed_device/navigator_managed_data.cc |
| 25 | +@@ -108,8 +108,14 @@ void NavigatorManagedData::OnServiceConnectionError() { |
| 26 | + !managed_configuration_service_.is_connected()) { |
| 27 | + managed_configuration_service_.reset(); |
| 28 | + } |
| 29 | ++ |
| 30 | ++ // Move the set to a local variable to prevent script execution in Reject() |
| 31 | ++ // from invalidating the iterator used by the loop. |
| 32 | ++ HeapHashSet<Member<ScriptPromiseResolver>> pending_promises; |
| 33 | ++ pending_promises_.swap(pending_promises); |
| 34 | ++ |
| 35 | + // Resolve all pending promises with a failure. |
| 36 | +- for (ScriptPromiseResolver* resolver : pending_promises_) { |
| 37 | ++ for (ScriptPromiseResolver* resolver : pending_promises) { |
| 38 | + resolver->Reject( |
| 39 | + MakeGarbageCollected<DOMException>(DOMExceptionCode::kNotAllowedError, |
| 40 | + kNotHighTrustedAppExceptionMessage)); |
0 commit comments